oss-security - CVE request: kernel: cfg80211: fix looping soft lockup in find

Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers

[<prev] [next>] [day] [month] [year] [list]

Date: Wed, 16 Sep 2009 13:32:57 +0800
From: Eugene Teo <eugeneteo@...nel.sg>
To: oss-security@...ts.openwall.com
CC: "Steven M. Christey" <coley@...us.mitre.org>
Subject: CVE request: kernel: cfg80211: fix looping soft lockup in find_ie()

The find_ie() function uses a size_t for the len parameter, and directly 
uses len as a loop variable.  If any received packets are malformed, it 
is possible for the decrease of len to overflow, and since the result is 
unsigned, the loop will not terminate. Change it to a signed int so the 
loop conditional works for negative values.

find_ie() was introduced in commit 2a519311 (v2.6.30-rc1).

Upstream commit: fcc6cb0c13555e78c2d47257b6d1b5e59b0c419a

Thanks, Eugene

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.